How to Load Config From AWS SSM Parameter Store

Why SSM Parameter Store instead of environment variables

The 12-factor app rule "store config in the environment" made sense when the alternative was hardcoding values. AWS SSM Parameter Store goes a step further: config lives in a managed store with versioning, IAM-gated access, and optional encryption (SecureString). Rotation becomes a parameter update + a process restart. No image rebuild, no Kubernetes rollout, no redeploy.

Reading a parameter with boto3

import os
import boto3

def load_database_url() -> str:
    ssm = boto3.client(
        "ssm",
        endpoint_url=os.environ.get("AWS_ENDPOINT_URL"),   # override for local/moto testing
        region_name=os.environ.get("AWS_DEFAULT_REGION", "us-east-1"),
    )
    try:
        return ssm.get_parameter(Name="/app/database/url")["Parameter"]["Value"]
    except Exception:
        # fall back to env if SSM is unreachable or the parameter is missing
        return os.environ["DATABASE_URL"]

The ["Parameter"]["Value"] path is the standard shape for a plain String parameter. For SecureString parameters add WithDecryption=True:

ssm.get_parameter(Name="/app/db/password", WithDecryption=True)["Parameter"]["Value"]

Verify the parameter exists before you deploy

aws ssm get-parameter --name /app/database/url
# {
#   "Parameter": {
#     "Name": "/app/database/url",
#     "Type": "String",
#     "Value": "postgresql://user:pass@db:5432/myapp",
#     ...
#   }
# }

Cache it - do not call SSM on every request

SSM GetParameter has a 40 req/s per-account rate limit and adds ~5-20 ms of latency. Read once at boot and store in a module-level variable:

_db_url: str | None = None

def get_database_url() -> str:
    global _db_url
    if _db_url is None:
        _db_url = load_database_url()
    return _db_url

For applications that need to pick up rotations without restarting, refresh the cached value on a background timer (e.g. every 5 minutes) rather than on every call.

Naming convention

Use a hierarchical path like /app/<env>/<service>/<param> - it maps cleanly to IAM resource ARNs, lets you lock down access by prefix, and makes it obvious which parameters belong to which service:

/app/prod/api/database_url
/app/prod/api/stripe_secret_key
/app/staging/api/database_url

IAM can then grant a role access to /app/prod/api/* without exposing staging or other services.